CVE-2017-7399 : Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.

Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows a read-only Cloudera Manager user to discover the usernames of other users and elevate the privileges of those users.

Published 2019-11-26 16:15:12

Updated 2019-12-04 18:34:36

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2017-7399

Cloudera » Cloudera Manager
Versions from including (>=) 5.7.0 and up to, including, (<=) 5.7.5
cpe:2.3:a:cloudera:cloudera_manager:*:*:*:*:*:*:*:*
Matching versions
Cloudera » Cloudera Manager
Versions from including (>=) 5.9.0 and up to, including, (<=) 5.9.1
cpe:2.3:a:cloudera:cloudera_manager:*:*:*:*:*:*:*:*
Matching versions
Cloudera » Cloudera Manager
Versions from including (>=) 5.5.0 and up to, including, (<=) 5.5.6
cpe:2.3:a:cloudera:cloudera_manager:*:*:*:*:*:*:*:*
Matching versions
Cloudera » Cloudera Manager
Versions from including (>=) 5.6.0 and up to, including, (<=) 5.6.1
cpe:2.3:a:cloudera:cloudera_manager:*:*:*:*:*:*:*:*
Matching versions
Cloudera » Cloudera Manager
Versions from including (>=) 5.3.0 and up to, including, (<=) 5.3.10
cpe:2.3:a:cloudera:cloudera_manager:*:*:*:*:*:*:*:*
Matching versions
Cloudera » Cloudera Manager
Versions from including (>=) 5.4.5 and up to, including, (<=) 5.4.10
cpe:2.3:a:cloudera:cloudera_manager:*:*:*:*:*:*:*:*
Matching versions
Cloudera » Cloudera Manager
Versions from including (>=) 5.1.0 and up to, including, (<=) 5.1.6
cpe:2.3:a:cloudera:cloudera_manager:*:*:*:*:*:*:*:*
Matching versions
Cloudera » Cloudera Manager
Versions from including (>=) 5.8.0 and up to, including, (<=) 5.8.3
cpe:2.3:a:cloudera:cloudera_manager:*:*:*:*:*:*:*:*
Matching versions
Cloudera » Cloudera Manager
Versions from including (>=) 5.0.0 and up to, including, (<=) 5.0.7
cpe:2.3:a:cloudera:cloudera_manager:*:*:*:*:*:*:*:*
Matching versions
Cloudera » Cloudera Manager
Versions from including (>=) 5.2.0 and up to, including, (<=) 5.2.7
cpe:2.3:a:cloudera:cloudera_manager:*:*:*:*:*:*:*:*
Matching versions
Cloudera » Cloudera Manager
Versions from including (>=) 5.4.0 and up to, including, (<=) 5.4.3
cpe:2.3:a:cloudera:cloudera_manager:*:*:*:*:*:*:*:*
Matching versions
Cloudera » Cloudera Manager » Version: 5.10.0
cpe:2.3:a:cloudera:cloudera_manager:5.10.0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2017-7399

EPSS FAQ

0.34%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 53 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-7399

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P	8.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2017-7399

CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-7399

https://docs.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html#concept_tvf_34r_1cb

Cloudera Security Bulletins | 5.x | Cloudera Documentation
Vendor Advisory

Jump to

Vulnerability Details : CVE-2017-7399

Products affected by CVE-2017-7399

Exploit prediction scoring system (EPSS) score for CVE-2017-7399

CVSS scores for CVE-2017-7399

CWE ids for CVE-2017-7399

References for CVE-2017-7399